Reverse engineering is the process of discovering the technological principles of a device, object or system through analysis of its structure, function and operation. The process often involves taking something (e.g., a mechanical device, electronic component, or software program) apart and analyzing its workings in detail. Reverse engineering is commonly applied to semiconductor integrated circuits to uncover their inner workings. At least one motivation for such an undertaking is to determine whether a competitor's product contains patent infringements or copyright infringements. Another reason is to confirm whether the fabrication of a particular integrated circuit conforms to the underlying design—did the fabrication facility “get it right.”
Semiconductor devices are complex, ranging from 1.0-micron single metal bipolar chips, through 0.35-micron BiCMOS—DiffusedMOS (BCDMOS) chips, to 65-nm, 12-metal microprocessors, and everything in between. Both aluminum and copper can be used for metal on the same chip. Depending on the process generation, the polysilicon gates and the source/drains can use different silicides. A variety of low-K dielectrics can be interspersed with fluorosilicate glass (FSG), phospho-silicate glass (PSG), and SiO2. Layer thicknesses vary greatly. Presently, such devices can have up to 12 layers of metal, and use an esoteric combination of materials to create both the conductors and dielectrics. They may have hundreds of millions of logic gates, plus huge analog, RF, memory, and other macro-cell areas. MEMs, inductors, and other devices are also being integrated on-chip.
Reverse engineering of such devices is typically an invasive and destructive process. Each layer of a multilayer device is removed, for example, by grinding. Images (e.g., pictures) of each layer are taken, for example, by an electron microscope. The inner workings of the semiconductor device can be obtained using such a technique, but not without a significant investment in effort and special equipment. For example, at least one problem for such an investigator is to bring everything into the right order to find out how everything works.
Reverse engineering of semiconductor-based products can broadly take several forms, including (i) system level analysis—analyzing operations and signal paths, and (ii) interconnections, and circuit extraction—typically accomplished by de-layering to transistor level, then extracting interconnections and components to create schematics.
During package removal, packages are etched off in a corrosive acid solution. A variety of acids at various temperatures are used depending on the composition and size of the particular package. These solutions dissolve away the packaging material, but do not damage the die. Hermetic and ceramic packages require different techniques that usually involve mechanical or thermal treatment to remove lids, or dice from substrates, or even polish away a ceramic substrate.
A de-layering lab needs to create a single sample of the semiconductor device at each metal layer, and at the polysilicon transistor gate level. As such, it needs to accurately strip off each layer, one at a time, while keeping the surface planar. This requires detailed recipes for removal of each layer. These recipes include a combination of methods such as plasma (dry) etching, wet etching, and polishing. As the complexity and variation of chips increases, so too does the number of recipes.
Full circuit extraction requires taking note of all transistors, capacitors, diodes, and other components, all interconnect layers, and all contacts and vias. This can be done manually or using automation. Full circuit extraction means taking note of all transistors, all contacts/vias between levels, and all interconnects at each level, and then condensing them to a schematic readable by a design engineer. Typically a block of circuitry is extracted at a time, and then cross-referenced so that a full schematic is available, if required. Unfortunately, such approaches are costly, complicated and destructive.